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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



VIETNAM VETERANS OF AMERICA, INC., 
8605 Cameron Street, Suite 400, 
Silver Spring, MD 20910, 

CITIZEN SOLDIER, INC., 
267 Fifth Avenue, Suite 901, 
New York, NY 10016, 

NATIONAL GULF WAR RESOURCE 
CENTER, INC., 
3027 Walnut St., 
Kansas City, MO 64108, 

RADIATED VETERANS OF 
AMERICA, INC., 
2533 N. Carson Street, 
Carson City, Nevada 89706, 

VETERANS FOR PEACE, INC., 
216 South Meramec Ave., 
Saint Louis, MO 63105, 

Charles L. CLARK, 
1245 Akele St., 
Kailua, HI 96734, 

David CLINE, 

17 Pierce Avenue #1, 

Jersey City, NJ 07307, 

James E. MALONE, 
2002 S. Norton St., 
Tucson, AZ 85713, and 

John ROWAN, 

8605 Cameron Street, Suite 400, 

Silver Spring, MD 20910, 

Plaintiffs, 



Case No. 
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R. James NICHOLSON, in his Official Capacity 
as Secretary of Veterans Affairs, 
810 Vermont Avenue, NW, 
Washington, DC 20420, and 

UNITED STATES DEPARTMENT OF 
VETERANS AFFAIRS, 
810 Vermont Avenue, NW, 
Washington, DC 20420, 

Defendants. 



COMPLAINT 

COME NOW PLAINTIFFS, Vietnam Veterans of America, Inc., Citizen Soldier, Inc., 
National Gulf War Resource Center, Inc., Radiated Veterans of America, Inc., Veterans For Peace, 
Inc., Charles. L. Clark, David Cline, James E. Malone, and John Rowan, and in support of their 
Complaint herein allege as follows: 

NATURE OF THE ACTION 

1 . This is an action for declaratory and injunctive relief and money damages for the 
violations of the Administrative Procedures Act and the Privacy Act of 1974. Plaintiffs represent 
approximately 26,500,000 individuals who have suffered emotional trauma and been placed in fear 
of identity theft, destruction of credit, and financial fraud because of Defendants' reckless disregard 
for the privacy of these citizen's basic personal information. 

2. Defendant Nicholson failed to properly perform the duties of the duties of his position 
as Secretary of Veterans Affairs ("Secretary") and did not ensure Plaintiffs' privacy rights were 



Case 1:06-cv-01038-JR Document 1 Filed 06/06/2006 Page 3 of 16 

protected from the intentional, willful, arbitrary and capricious actions and inactions of his 
subordinates. 

3. Defendant United States Department of Veterans Affairs ("Department" or "VA") 
flagrantly disregarded the privacy rights of essentially every living man and woman to have worn a 
United States military uniform, and perhaps others, by illegally maintaining a database of personal 
information unrelated to claims for benefits. 

4. Defendant VA arrogantly compounded it disregard for veterans' privacy rights by 
recklessly failing to make even the most rudimentary effort to safeguard this trove of the personally 
identifiable information from unauthorized disclosure. Thus, the information was unencrypted, 
easily copied, and, apparently, available to anyone aware of its existence. VA's failure, despite 
repeated calls for correction of these long-standing, fundamental security deficiencies, allowed 
millions of citizen's private information to be surreptitiously disclosed to unknown individuals for 
unknown purposes. 

5. The result of Defendants' reckless disregard of Plaintiffs' privacy rights was the 
largest unauthorized disclosure of Social Security numbers in history. 

6. Defendants' actions and inactions have inflicted, and will long continue to inflict, real 
costs and emotional pain and suffering on Plaintiffs and every other living veteran and their families. 

JURISDICTION AND VENUE 

7. Jurisdiction of this Court is invoked pursuant to 28 U.S.C. §T331 because this is a 
civil action arising under the laws of the United States. Jurisdiction is also invoked pursuant to 5 
U.S.C. §§ 552a(g)(l), (5) because this is a civil action to enforce a liability created under 5 U.S.C. 
§ 552a after September 27, 1975. 



Case 1:06-cv-01038-JR Document 1 Filed 06/06/2006 Page 4 of 16 

8. Venue is appropriate in this Court pursuant to 28 U.S. C. § 1391 because a substantial 
part of the events or omissions giving rise to the claims occurred in this district. 

PARTIES 

PLAINTIFFS 

9. Plaintiff Vietnam Veterans of America, Inc. ("VVA") is a Congressionally-chartered 
national veterans' service organization. Many of the group's individual members and their families 
are in receipt of, or are seeking entitlement to, VA benefits. VVA assists disabled veterans and their 
families, both members and non-members, in the prosecution of claims for benefits by providing 
them withpro bono legal representation before the VA, the Board of Veterans Appeals and the U.S. 
Court of Appeals for Veterans Claims. VVA's advocacy on behalf of all veterans extends to the 
legislative arena. VVA has approximately 53,400 members, all of whom are believed to be 
identified in Defendant's lost records. 

1 0. Plaintiff Citizen Soldier, Inc. is a non-profit active duty military and veterans' rights 
advocacy organization. The organization advocates for the rights of American military veterans and 
active duty personnel over a wide range of issues, including the Agent Orange litigation. Citizen 
Soldier has also organized educational and advocacy campaigns, via publications and the internet, on 
a range of health and safety issues of concern to veterans, Citizen Soldier currently has 
approximately 7,200 members nationwide, of which approximately 1,500 are military veterans. 

1 1 . Plaintiff National Gulf War Resource Center, Inc. is a national coalition of more than 
twenty Gulf War veterans advocacy groups founded in 1995 to assisting military veterans of 
operations in the Persian Gulf Region from 1990 to the current day. The organization advocates for 
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scientific research and VA medical care and benefits related to the health issues of veterans of 
Persian Gulf conflicts. 

12. Plaintiff Radiated Veterans of America, Inc. is a non-profit organization dedicated to 
advocate for, and aid, past, current and future members of the Armed Forces of the United States of 
America who were or may be exposed to ionizing radiation in fulfilling their duties, their families, 
and survivors. Radiated Veterans of America, Inc. has approximately 40 members, essentially all of 
which are military veterans. 

13. Plaintiff Veterans For Peace, Inc. is a national organization of men and women 
veterans of the Spanish Civil War, World War II, Korea, Vietnam, and other conflicts, as well as 
peacetime veterans. The organization has approximately 4,500 veteran members and 1 ,000 associate 
members organized in chapters across the country. 

14. Plaintiff Charles L. Clark is a veteran of World War II and a radiation-exposed 
veteran of the occupation of Nagasaki. Plaintiff Clark has submitted claims for VA benefits for the 
adverse health effects caused by his in-service radiation exposure. 

15. Plaintiff David Cline is a disabled Vietnam combat veteran. During his tour of duty 
as a rifleman with the 25 th Infantry Division, he was received three Purple Hearts for wounds 
received in combat, the Bronze Star for bravery, the Combat Infantry Badge, and other Vietnam 
service medals. 

16. Plaintiff James E. Malone is cold war veteran who was exposed to radiation from 
United States atomic testing. He has filed claims for benefits with VA for service-connected 
conditions. 
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1 7. Plaintiff John Rowan is the President of Vietnam Veterans of America and a veteran 
of service in the United States Air Force. 

DEFENDANTS 

1 8. Defendant R. James Nicholson is the Secretary of Veterans Affairs and is the official 
responsible for the proper execution and administration of all laws administered by the Department 
and for the control, direction, and management of the Department. 

19. Defendant VA is an executive department of the federal government and is, therefore, 
an "agency" for purposes of the Privacy Act of 1974. 

STATEMENT OF THE FACTS 

20. On May 3, 2006, a laptop computer and external data storage device or devices were 

reported stolen from the home of a VA employee. The laptop computer and data storage device or 
devices contained a copy of a collection or grouping of information pertaining to approximately 26.5 
million persons (the "Personal Information"), including military veterans and their spouses. The 
Personal Information contained individual identifying information including, but not limited to, 
names, addresses, phone numbers, social security numbers, and dates of birth. In addition, an 
unknown number of individual's records contained disability information and information related to 
possible exposure to biological and chemical agents. None of the information was encrypted or 
similarly protected. 

2 1 . The incident was the largest unauthorized disclosure of Social Security data ever. The 
disclosure was so patently egregious and unlawful that any reasonable government official would 
have known it to be unlawful. 
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22. The VA employee reported the Personal Information theft to one or more VA 
officials. These VA officials were aware of the egregious and unlawful disclosure of the Personal 
Information soon after the occurrence, yet these VA officials willfully and intentionally decided to 
conceal the disclosure and did not to report the incident to other VA official, federal law 
enforcement, or inform the individuals whose personal information had been disclosed without 
authorization. These failures exhibit Defendants' reckless disregard for Plaintiffs' privacy rights, 
intentional and willful violations of the Privacy Act, and were otherwise not in accordance with law. 

23. No VA official charged with protecting the Personal Information pursuant to the 
Privacy Act and who was knowledgeable of the egregious and unauthorized disclosure informed 
Defendant VA's Inspector General of the disclosure. The Inspector General only learned of the 
incident through an offhand remark on May 10, 2006. Then, the Inspector General further 
demonstrated VA's reckless disregard for Plaintiffs' privacy rights and intentional and willful 
disregard for Privacy Act requirements by failing to interview the employee in question until May 
15,2006, five days later. 

24. Defendant Nicholson was informed of the patently egregious and unlawful disclosure 
on May 16, 2006, but the Federal Bureau of Investigation ("FBI") was not contacted until May 17, 
2006. Defendant Nicholson did not publicly inform Plaintiffs or any other individuals of VA's 
egregious and patently unlawful disclosure of the Personal Information until May 22, 2006, 1 9 days 
after the reported theft. Contrary to Defendant Nicholson'sjposf hoc public statements this delay was 
not a result of a premeditated plan to avoid public concern, but actually resulted from Defendants 
VA's officials' reckless disregard for Plaintiffs' privacy rights and failure to promptly and 
forthrightly report the disclosure or otherwise observe the procedures required by law. 
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25. Defendants' actions and inactions in failing to report the unauthorized disclosure of 
the Personal Information were arbitrary, capricious and without observance of procedures required 
by law. 

26. Defendant VA has been repeatedly informed of recurring, systemic, and fundamental 
deficiencies in its information security, but failed to effectively respond. VA's own Inspector 
General has for years criticized the Department for lax information security. Despite the repeated 
identification of problems, VA has been unable or unwilling to properly secure the personal 
information under its control. These repeated failures to correct known vulnerabilities of VA's 
safeguards for Plaintiffs' private information demonstrated a reckless disregard for privacy rights and 
intentional or willful violations of the Privacy Act. 

27. The VA employee who reported the laptop computer stolen routinely took sensitive 
private information, including the Personal Information, home since at least 2003. The employee 
had not received a security background check for approximately 32 years. 

28. The Personal Information disclosed on May 3, 2006, could be retrieved by the name 
of an individual or by some identifying number, symbol, or other identifying particular assigned to an 
individual. 

29. VA flagrantly disregarded Plaintiffs privacy and caused Plaintiffs adverse effects by 
not obtaining prior written consent of Plaintiffs, or any individual, before disclosing the Personal 
Information to any other individual or government agency. 

30. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to observe the procedures required by law for disclosure of private information, including the 
Personal Information, without the prior written consent of the affected individuals. 

8 
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3 1 . VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
disclosing, or allowed disclosure of, the Personal Information to officials and employees who did not 
have a need for such records and information in the performance of their duties. 

32. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to keep or maintain an accurate accounting of the disclosures of the Personal Information. 

33. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects 
assembling and maintaining the Personal Information in a system of records although the information 
was not relevant and necessary to accomplish a purpose required by statute or by executive order of 
the President. 

34. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs ' adverse effects by 
failing to collect the Personal Information directly from the subject individuals to the greatest extent 
practicable although the information may result in adverse determinations about an individual's 
rights, benefits, and privileges under a Federal program. 

35. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to publish a notice of the existence and character of the Personal Information system of 
records in the Federal Register. 

36. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to make reasonable efforts to assure that the Personal Information records were accurate, 
complete, timely, and relevant for VA purposes prior to disseminating a record about an individual to 
any person other than an agency. 

37. VA flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' adverse effects by 
failing to establish or implement appropriate administrative, technical, and physical safeguards to 

9 
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insure the security and confidentiality of records and to protect against anticipated threats or hazards 
to the records security or integrity, which could result in substantial harm, embarrassment, 
inconvenience, or unfairness to any individual on whom information was maintained. VA's security 
deficiencies allowed, and continue to allow, a single individual to compromise through disclosure the 
entire Personal Information system of records. VA's entrenched unwillingness or inability to 
establish and maintain adequate information security is an abuse of discretion and an intentional and 
willful failure to observe procedures required by law. 

38. Defendant Nicholson was ultimately responsible for control, direction, and 
management of VA's processes, policies, and procedures for compliance with the Privacy Act of 
1974, including, but not limited to VA Handbook 6300.5, "Procedures for Establishing and 
Managing Privacy Act Systems of Records," but failed to ensure those processes, policies, and 
procedures were adequately implemented by his subordinates. Defendant Nicholson knew, or should 
have known, that VA had long-standing information security deficiencies that threatened Plaintiffs' 
privacy rights, but did not ensure correction or mitigation of those deficiencies. 

39. Defendant Nicholson flagrantly disregarded Plaintiffs' privacy and caused Plaintiffs' 
adverse effects by failing to establish and ensure lawful compliance by his subordinates with 
appropriate administrative, technical, and physical safeguards to insure the security and 
confidentiality of records and to protect against anticipated threats or hazards to the records security 
or integrity, which could result in substantial harm, embarrassment, inconvenience, or unfairness to 
any individual on whom information was maintained. 
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40. Each of Defendants' failures complained of caused Plaintiffs adverse effects 
including, but not limited to, embarrassment, inconvenience, unfairness, mental distress, emotional 
trauma, pecuniary damages and the threat of current and future substantial harm from identity theft. 

41 . The real threat of identity theft and similar adverse effects of VA's illegal actions and 
inactions Privacy Act violations requires affirmative actions by Plaintiffs to recover peace of mind, 
emotional stability, and personal security including, but not limited to, frequently obtaining and 
reviewing credit reports, bank statements, and other similar information, obtaining credit watch 
services, and closing financial accounts. Plaintiffs have, and will continue to, suffer tangible and 
intangible damages for the foreseeable future. 

CLASS ACTION ALLEGATIONS 

42. This action is maintainable as a class action pursuant to Federal Rules of Civil 

Procedure 23(a), (b)(l)-(3). 

43. The class consists of all persons who have been adversely effected by Defendants' 
APA and Privacy Act violations. 

44. The class is so numerous that joinder of all members is impractible. The class size is 
approximately 26,500,000, which is the number of individuals whose information Defendants admit 
was collected and maintained in the missing system of records. 

45. Joinder of class members' individual actions is impractical because of the 
geographical diversity of class members, the limited ability of individual class members to institute 
separate suits, and the general nature of the underlying action and relief sought. 

46. Class representatives' counsel, Ogletree, Deakins, Nash, Smoak & Stewart, P.C. is 
appropriately qualified and experienced to represent the class. 

11 
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47. There are substantial questions of fact and law common to all class members. The 
legal issues raised in this Complaint are limited to violations of the APA and Privacy Act. The 
factual issues of whether Defendants violated one or more legal requirements are common to all 
class members. Similarly, the relief Plaintiffs seek is dominated by equitable remedies. The facts, 
circumstances, and merits of the case, therefore, apply equally to all class members. 

48. The claims of the representative Plaintiffs are typical of the claims of the class 
members. Representative Plaintiffs are military veterans listed in one or more VA system of records 
who have had their personal information improperly maintained and disclosed by Defendants. 

49. The representative Plaintiffs will fairly and adequately protect the interests of the 
class. Several Plaintiffs have previously come forward, at their own expense, to publicly raise the 
issue of Defendants' conduct. Furthermore, the representative Plaintiffs' claims span the breadth of 
issues raised in this action. 

50. Defendants have acted and refused to act on grounds generally applicable to the class, 
making appropriate final injunctive and declaratory relief with respect to the class as a whole. 

5 1 . The prosecution of separate actions by individual class members would create a risk 
of inconsistent results that could establish incompatible standards of conduct for Defendants. 

52. Defendants' liability for damages can be established by facts and circumstances 
common to the class as a whole and do not require the examination of Plaintiffs' individual 
circumstances. 

53. Questions of law and fact common to members of the class predominate over any 
questions affecting only individual members. 
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54. A class action is superior in this case to other methods for a fair and efficient 
adjudication of the controversy because: (A) the common interests of the class members 
predominate over any individual interest in controlling prosecution or control of separate actions; 
(B) no similar litigation concerning the controversy is known to have been commenced by members 
of the class; (C) concentrating litigation of this action in this Court is appropriate to ensure 
appropriate, consistent, and efficient resolution of the constitutional issues raised in the district 
where the offending conduct occurred, continues to occur, and could occur in the future; and (D) the 
difficulties in managing an action involving this class are significantly reduced by existing databases 
of potential class members prepared by the government and veteran service organizations. 

FIRST CLAIM FOR RELIEF 

Violation of the Administrative Procedures Act 

5 5 . Plaintiffs reassert their allegations set forth in Paragraphs ( 1 ) through (54) above and 
incorporate them by reference into this First Claim for Relief. 

56. Defendant VA possesses personal information of Plaintiffs and millions of other 
veterans and citizens. VA has repeatedly demonstrated an inability or unwillingness to implement, 
or callous disregard for, fundamental procedures to provide minimally acceptable safeguards for the 
personal and private information in its possession. 

57. Defendant Nicholson is ultimately responsible in his official capacity for safeguarding 
citizen's private information under VA control pursuant to applicable laws, including the Privacy Act 
of 1974 and the Administrative Procedures Act, but has been unable or unwilling to require 
compliance with those laws. 
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58. Defendants' actions and inactions in failing to safeguard Plaintiffs' private 
information were arbitrary, capricious, and otherwise not in accordance with law. 

59. Plaintiffs suffered, and continue to suffer, harm as a result of Defendants' actions and 
from actions improperly withheld or unreasonably delayed. 

60. Plaintiffs are entitled to equitable relief for Defendants' violation of Plaintiffs' rights 
pursuant to the Administrative Procedures Act. 

SECOND CLAIM FOR RELIEF 

Violation of the Privacy Act 

6 1 . Plaintiffs reassert their allegations set forth in Paragraphs ( 1 ) through (60) above and 
incorporate them by reference into this Second Claim for Relief. 

62. Defendants violated the Privacy Act of 1 974. 

63. Each of Defendants' violations of the Privacy Act was intentional or willful. 

64. Each of Defendants' Privacy Act violations caused Plaintiffs adverse effects. 

65. Defendants' unauthorized disclosure of individuals' names, addresses, and phone 
numbers linked to their Social Security numbers has, in particular, placed each Plaintiff in legitimate 
fear of identity theft, corruption of their credit files, and plundering of bank accounts and retirement 
funds. 

66. Plaintiffs suffered actual damages as a result of Defendants' Privacy Act violations. 

67. Plaintiffs are entitled to monetary relief and the costs of this action together with 
reasonable attorney fees. 
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PRAYER FOR RELIEF 

WHEREFORE, Plaintiffs pray as follows: 

(a) That this Court issue a declaratory judgment that Defendants violated, and continue 
to violate, Plaintiffs ' rights under the Administrative Procedures Act and Privacy Act 
of 1974; 

(b) That this Court order Defendant Nicholson to immediately identify in the Federal 
Register the existence and character of every system of records maintained by VA 
and make available to any individual therein, their authorized representatives, or 
survivors, each record maintained in any VA system of records pertaining to that 
individual; 

(c) That this Court order Defendant Nicholson to immediately identify in the Federal 
Register each use of every system of records, including any Use of that system or 
individuals records thereof known as a "project" or "projects," and the explicit 
statutory or other legal basis for that use or project; 

(d) That this Court permanently enjoin Defendant VA, its officers, agents, employees, 
and those acting for and with them, from accessing, viewing, handling, disclosing, or 
in any way transferring any record or system of records subject to Privacy Act 
requirements until an independent panel of experts finds that adequate information 
security has been established and implemented by VA, unless such activity is 
explicitly allowed by Court order and under supervision of persons independent of 
VA, such supervision to be at VA expense; 
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(e) That this Court enjoin Defendant VA, its officers, agents, employees, and those 
acting for and with them from removing any device capable of storing, containing, or 
transferring any record or system of records, including, but not limited to, laptop 
computers, portable hard drives, memory stick or similar devices, and "iPods" and 
similar devices, from property under VA's supervision and control until and unless 
VA demonstrates that adequate information security has been established to the 
Court's satisfaction. 

(f) That this Court grant to Plaintiffs judgment against Defendant VA for damages in an 
amount of $ 1 ,000.00 for each individual who was adversely affected by Defendant's 
Privacy Act violations; 

(g) That this Court grant to Plaintiffs their costs and reasonable attorney's fees; and 
(h) That this Court grant such additional relief as the Court deems proper and just. 

Respectfully submitted, 



"L. C^ayjdejMie (D.C. Bar No. 421357) 
Douglas^L Rosinski (D.C. Bar No. 461275) 
Ogletree, Deakins, Nash, 

Smoak & Stewart, P.C. 
1320 Main St. 
Columbia, SC 29201-3266 
Attorneys for Plaintiffs 



DATED: June 6, 2006 
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